A board member's perspective of the RubyGems controversy

My point is that he chose to communicate the way he did; it is poorly thought out and extremely difficult to accept as an explanation.

Objective tests you yourself can perform.

1) How much of the publication talks about himself? Why is that relevant?

2) How much does it directly provide links, context, history? Can you find the opposing point of view directly linked from it, or is it omitted?

3) From reading the content, does this person represent the board, or not? Do they make any conflicting claims that are difficult to both be true at the same time?

4) A coup d'etat is a "a sudden, violent, and unlawful seizure of power from a government"

Were the people who lost access acting as a governing body? Was the loss of access sudden and unexpected? Did the loss of access follow any of the rules of the governing group? Did the loss of access harm individuals?

With the answers to the above, reflect on the following:

Why would someone write about themselves, their experience, etc for 6 paragraphs? Would you say it is clear they have only been appointed since Jan 2025? Or are they trying to establish themselves as an authority? If they are not attempting to appeal to authority, why is it relevant?

Did they actually apologise? If so, to who? Is it specific? Does it clearly articulate what the person did, admit fault, recognise harm? Or is there downplaying of impact, vague language, downplaying of involvement?

Does it characterise the contrary point of view in a way that trivial uses the concerns? Are the conversations "emotional" or is it implied the people experiencing the negative act are? Is the author emotional?

If you were the person or people affected, would you accept this explanation? If you were the person taking these actions, would you explain why like this? Why or why not?

I strongly encourage you to do this exercise, putting aside feelings or initial responses even if you think I am wrong.

For any company that wants to secure and maintain critical source infrastructure for a language, community/maintainer relations is a fundamental responsibility. It is not to be waved away with quasi-candid admissions that you're just too small a team, too technical, etc. Even if this board member is being totally sincere about his feelings for Ruby and its community, it changes little.

> Some of those companies specifically pay Ruby Central to ensure the security and stability of that part of the supply chain, but then discovered that people with no active affiliation or agreement in place had top level privileges to some of this critical infrastructure.

This is the most candid bit of the article.

RubyCentral seems to have screwed up. The sense I get after reading this paragraph is that RC's non-apologies about poor communication are smoke. Why did they have to move this quickly/silently? Well...

If you are taking money from businesses in exchange for certain assurances about the security/soundness of RubyGems, you have a responsibility the minute pen leaves paper to KYC(ontributors). Not when there's suddenly a fire, or when your clients notice.

By all appearances, RC was negligent, if not necessarily in the legal sense. They were highly reactive in response to a problem they should have been across already, and they have paid for it with a chunk of the Ruby community's trust.

To now retcon this action as poorly-communicated but ultimately noble and security-minded does not sit very well.

Thanks - that was helpful indeed. From there, I also found the linked post by Tekin Süleyman ( https://tekin.co.uk/2025/09/the-ruby-community-has-a-dhh-pro... ) to be informative.

Agreed. I wish the communications would move away from FUD that could scare people away from using Ruby when things are already splintered. A more honest and transparent accounting of what really happened is necessary.

It does not, for me.

Given that access was cut, then restored, then cut again, then days, then someone finally says "hey were were going to lose critical funding" makes it seem like a post-facto excuse for a hostile takeover.

And the whole "oh, well, we're bad at comms" makes it sound even worse!

Which is the whole crux of the issue. At no point in any of this did Ruby Central do anything reasonable. The they tried to explain that their unreasonable actions were reasonable, if you only knew the things they knew, which they were for some reason unable to tell people until just now.

Could it be true? Sure, absolutely.

Does it seem reasonable at the moment? Hell no.